Legal Center

Information Security

Version 1.0 · Effective October 15, 2026 · Public summary

This is a translation. In case of any discrepancy, the Portuguese version prevails.

SecurityPag protects payment data through tokenization in a PCI DSS environment, encryption, least-privilege access, and continuous monitoring. This summary describes the controls adopted and what we expect from Users. The full policy is internal and reviewed at least once a year.

1. References

The program follows PCI DSS version 4.0.1, Article 46 of the LGPD, CD/ANPD Resolution No. 15/2024 on incidents, and the security requirements of the Card Networks and Partner Institutions. ISO/IEC 27001 and 27701 and OWASP are used as best-practice references.

PCI DSS status: SecurityPag is compliant with PCI DSS at Level 1, validated annually by a Report on Compliance (ROC) and an Attestation of Compliance (AOC), and undergoes an annual penetration test.

2. Governance

• Information security officer: Compliance Department, together with the security team (security@securitypag.com).
• Policies approved by senior management and reviewed annually.
• Classification of information and inventory of assets and personal data.
• Security risk management with an action plan monitored by senior management.

3. Protection of payment data

• Card data is captured only by the Checkout or the tokenizer and replaced by a token. The card security code is never stored after authorization.
• Traffic protected by TLS 1.2 or higher; sensitive data at rest encrypted with AES-256 and keys managed in a secure module or key management service.
• Cardholder data environment segmented from the rest of the network.
• 3-D Secure 2 authentication and tokenized digital wallets.

4. Access control

• Access granted on a least-privilege basis and periodically reviewed.
• Multi-factor authentication for employees and for sensitive User operations.
• Separate test and production environments, with distinct API keys.
• Logging of access and administrative actions, retained as required by law.

5. Secure development

• Code review and static and dynamic analysis throughout the development cycle.
• Penetration testing by an independent company at least once a year and after significant changes.
• Vulnerability remediation within timeframes based on criticality: critical within 7 days, high within 30 days.
• Script control on the Checkout, required by PCI DSS 4.0.1, to prevent malicious code on the payment page.

6. Monitoring and incident response

• 24-hour monitoring with alerts for anomalous behavior.
• Incident response plan tested at least once a year.
• Incidents that may create a relevant risk or harm to data subjects are reported to the ANPD and to the data subjects within 3 business days, pursuant to CD/ANPD Resolution No. 15/2024, and to the Partner Institutions, Card Networks, and the Central Bank of Brazil when required.
• Incidents affecting the service are reported at https://securitypag.com.

7. Continuity

• Redundant infrastructure across more than one availability zone.
• Encrypted backups that are periodically tested.
• Continuity plan with an annual test. The recovery time and maximum data loss objectives of the payment systems are defined in the plan and reviewed after each test.

8. Suppliers

Suppliers with access to data or systems undergo a security assessment before engagement and periodic review. Contracts include confidentiality, data protection, incident reporting, and audit right clauses.

9. People

Employees sign a confidentiality agreement, undergo background checks appropriate to their role, and receive annual training on security and scam prevention.

10. Anti-fraud

Each Transaction undergoes real-time risk analysis, with device identification, velocity rules, restriction lists, and statistical models. The Platform detects and blocks mass card testing.

11. What we expect from Users

• Enable two-factor authentication and do not share Credentials.
• Store API keys in a secure vault and replace them if exposure is suspected.
• Validate the webhook signature before releasing products.
• Keep plugins, stores, and servers up to date.
• Use the tokenizer or the Checkout for cards; anyone who transmits clear card data needs their own PCI DSS certification.

12. Responsible vulnerability disclosure

12.1. Found a vulnerability? Send the details to security@securitypag.com. We acknowledge receipt within 2 business days and keep you informed of progress.

12.2. We will not take legal action against anyone who acts in good faith, without accessing data beyond the minimum necessary to demonstrate the issue, without degrading the service, without social engineering, and without disclosing before the fix.

13. Scams in the name of SecurityPag

SecurityPag never asks for a password, verification code, or API key, nor requests payment to release a Balance. Our official channels are listed in Clause 27 of the Terms of Use. Suspicious messages may be forwarded to security@securitypag.com.

Other Legal Center documents